[prev in list] [next in list] [prev in thread] [next in thread]
List: openembedded-core
Subject: Re: [OE-core][dunfell 07/16] QEMU: CVE-2022-4144 QXL: qxl_phys2virt unsafe address translation can l
From: "Martin Jansa" <Martin.Jansa () gmail ! com>
Date: 2023-01-31 7:39:40
Message-ID: CA+chaQeh-fC6FGFcaR0nmoe7LEQeuRSCzm-sE9gn_ZeW_v+HJQ () mail ! gmail ! com
[Download RAW message or body]
[Attachment #2 (multipart/alternative)]
On Tue, Jan 31, 2023 at 8:18 AM Martin Jansa via lists.openembedded.org
<Martin.Jansa=gmail.com@lists.openembedded.org> wrote:
> I haven't checked yet in dunfell, but in kirkstone this commit merged last
> week breaks nativesdk-qemu builds.
>
I can confirm it fails the same with this commit from Hitendra in dunfell:
nativesdk-qemu/4.2.0-r0/qemu-4.2.0/hw/display/qxl.c:1508:67: error: 'size'
undeclared (first use in this function); did you mean 'gsize'?
> 1508 | if (!qxl_get_check_slot_offset(qxl, pqxl, &slot, &offset,
size)) {
> >
^~~~
> >
gsize
as well as the same backport from Bhabu in kirkstone (already merged):
https://git.openembedded.org/openembedded-core/commit/?h=kirkstone&id=4cb3874abf4fdeb04337a48a14c765ba9b2269d4
To reproduce this just enable "spice" PACKAGECONFIG in nativesdk-qemu.
Hitendra, Bhabu: please have a look.
Regards,
>
> This chunk:
> +@@ -1486,7 +1505,7 @@ void *qxl_phys2virt(PCIQXLDevice *qxl, QXLPHYSICAL
> pqxl, int group_id)
> + offset = le64_to_cpu(pqxl) & 0xffffffffffff;
> + return (void *)(intptr_t)offset;
> + case MEMSLOT_GROUP_GUEST:
> +- if (!qxl_get_check_slot_offset(qxl, pqxl, &slot, &offset)) {
> ++ if (!qxl_get_check_slot_offset(qxl, pqxl, &slot, &offset, size))
> {
> + return NULL;
> + }
> + ptr = memory_region_get_ram_ptr(qxl->guest_slots[slot].mr);
>
> Uses size parameter which was added in previous commit (which wasn't
> backported):
>
> https://gitlab.com/qemu-project/qemu/-/commit/8efec0ef8bbc1e75a7ebf6e325a35806ece9b39f
>
> So either both commits need to be backported or this one reworked not to
> use undeclared size as it leads to:
>
> > ../qemu-6.2.0/hw/display/qxl.c: In function 'qxl_phys2virt':
> > ../qemu-6.2.0/hw/display/qxl.c:1477:67: error: 'size' undeclared (first
> use in this function); did you mean 'gsize'?
> > 1477 | if (!qxl_get_check_slot_offset(qxl, pqxl, &slot,
> &offset, size)) {
> > >
> ^~~~
> > >
> gsize
>
> I'm surprised this wasn't caught on autobuilder already, maybe it's
> triggered only with extra PACKAGECONFIG options we have enabled:
> PACKAGECONFIG:append:class-nativesdk = " virglrenderer epoxy spice libusb
> usb-redir"
>
> Regards,
>
>
> On Wed, Jan 25, 2023 at 3:42 PM Steve Sakoman <steve@sakoman.com> wrote:
>
> > From: Hitendra Prajapati <hprajapati@mvista.com>
> >
> > Upstream-Status: Backport from
> > https://gitlab.com/qemu-project/qemu/-/commit/6dbbf055148c6f1b7d8a3251a65bd6f3d1e1f622
> >
> > Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
> > Signed-off-by: Steve Sakoman <steve@sakoman.com>
> > ---
> > meta/recipes-devtools/qemu/qemu.inc | 1 +
> > .../qemu/qemu/CVE-2022-4144.patch | 103 ++++++++++++++++++
> > 2 files changed, 104 insertions(+)
> > create mode 100644 meta/recipes-devtools/qemu/qemu/CVE-2022-4144.patch
> >
> > diff --git a/meta/recipes-devtools/qemu/qemu.inc
> > b/meta/recipes-devtools/qemu/qemu.inc
> > index fff2c87780..898fa1a8d8 100644
> > --- a/meta/recipes-devtools/qemu/qemu.inc
> > +++ b/meta/recipes-devtools/qemu/qemu.inc
> > @@ -115,6 +115,7 @@ SRC_URI = "
> > https://download.qemu.org/${BPN}-${PV}.tar.xz \
> > file://CVE-2021-3638.patch \
> > file://CVE-2021-20196.patch \
> > file://CVE-2021-3507.patch \
> > + file://CVE-2022-4144.patch \
> > "
> > UPSTREAM_CHECK_REGEX = "qemu-(?P<pver>\d+(\.\d+)+)\.tar"
> >
> > diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2022-4144.patch
> > b/meta/recipes-devtools/qemu/qemu/CVE-2022-4144.patch
> > new file mode 100644
> > index 0000000000..3f0d5fbd5c
> > --- /dev/null
> > +++ b/meta/recipes-devtools/qemu/qemu/CVE-2022-4144.patch
> > @@ -0,0 +1,103 @@
> > +From 6dbbf055148c6f1b7d8a3251a65bd6f3d1e1f622 Mon Sep 17 00:00:00 2001
> > +From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
> > +Date: Mon, 28 Nov 2022 21:27:40 +0100
> > +Subject: [PATCH] hw/display/qxl: Avoid buffer overrun in qxl_phys2virt
> > + (CVE-2022-4144)
> > +MIME-Version: 1.0
> > +Content-Type: text/plain; charset=UTF-8
> > +Content-Transfer-Encoding: 8bit
> > +
> > +Have qxl_get_check_slot_offset() return false if the requested
> > +buffer size does not fit within the slot memory region.
> > +
> > +Similarly qxl_phys2virt() now returns NULL in such case, and
> > +qxl_dirty_one_surface() aborts.
> > +
> > +This avoids buffer overrun in the host pointer returned by
> > +memory_region_get_ram_ptr().
> > +
> > +Fixes: CVE-2022-4144 (out-of-bounds read)
> > +Reported-by: Wenxu Yin (@awxylitol)
> > +Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1336
> > +
> > +Signed-off-by: Philippe Mathieu-Daudà © <philmd@linaro.org>
> > +Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
> > +Message-Id: <20221128202741.4945-5-philmd@linaro.org>
> > +
> > +Upstream-Status: Backport [
> > https://gitlab.com/qemu-project/qemu/-/commit/6dbbf055148c6f1b7d8a3251a65bd6f3d1e1f622
> > ]
> > +CVE: CVE-2022-4144
> > +Comments: Deleted patch hunk in qxl.h,as it contains change
> > +in comments which is not present in current version of qemu.
> > +
> > +Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
> > +---
> > + hw/display/qxl.c | 27 +++++++++++++++++++++++----
> > + 1 file changed, 23 insertions(+), 4 deletions(-)
> > +
> > +diff --git a/hw/display/qxl.c b/hw/display/qxl.c
> > +index cd7eb39d..6bc8385b 100644
> > +--- a/hw/display/qxl.c
> > ++++ b/hw/display/qxl.c
> > +@@ -1440,11 +1440,13 @@ static void qxl_reset_surfaces(PCIQXLDevice *d)
> > +
> > + /* can be also called from spice server thread context */
> > + static bool qxl_get_check_slot_offset(PCIQXLDevice *qxl, QXLPHYSICAL
> > pqxl,
> > +- uint32_t *s, uint64_t *o)
> > ++ uint32_t *s, uint64_t *o,
> > ++ size_t size_requested)
> > + {
> > + uint64_t phys = le64_to_cpu(pqxl);
> > + uint32_t slot = (phys >> (64 - 8)) & 0xff;
> > + uint64_t offset = phys & 0xffffffffffff;
> > ++ uint64_t size_available;
> > +
> > + if (slot >= NUM_MEMSLOTS) {
> > + qxl_set_guest_bug(qxl, "slot too large %d >= %d", slot,
> > +@@ -1468,6 +1470,23 @@ static bool
> > qxl_get_check_slot_offset(PCIQXLDevice *qxl, QXLPHYSICAL pqxl,
> > + slot, offset, qxl->guest_slots[slot].size);
> > + return false;
> > + }
> > ++ size_available = memory_region_size(qxl->guest_slots[slot].mr);
> > ++ if (qxl->guest_slots[slot].offset + offset >= size_available) {
> > ++ qxl_set_guest_bug(qxl,
> > ++ "slot %d offset %"PRIu64" > region size
> > %"PRIu64"\n",
> > ++ slot, qxl->guest_slots[slot].offset + offset,
> > ++ size_available);
> > ++ return false;
> > ++ }
> > ++ size_available -= qxl->guest_slots[slot].offset + offset;
> > ++ if (size_requested > size_available) {
> > ++ qxl_set_guest_bug(qxl,
> > ++ "slot %d offset %"PRIu64" size %zu: "
> > ++ "overrun by %"PRIu64" bytes\n",
> > ++ slot, offset, size_requested,
> > ++ size_requested - size_available);
> > ++ return false;
> > ++ }
> > +
> > + *s = slot;
> > + *o = offset;
> > +@@ -1486,7 +1505,7 @@ void *qxl_phys2virt(PCIQXLDevice *qxl, QXLPHYSICAL
> > pqxl, int group_id)
> > + offset = le64_to_cpu(pqxl) & 0xffffffffffff;
> > + return (void *)(intptr_t)offset;
> > + case MEMSLOT_GROUP_GUEST:
> > +- if (!qxl_get_check_slot_offset(qxl, pqxl, &slot, &offset)) {
> > ++ if (!qxl_get_check_slot_offset(qxl, pqxl, &slot, &offset,
> > size)) {
> > + return NULL;
> > + }
> > + ptr = memory_region_get_ram_ptr(qxl->guest_slots[slot].mr);
> > +@@ -1944,9 +1963,9 @@ static void qxl_dirty_one_surface(PCIQXLDevice
> > *qxl, QXLPHYSICAL pqxl,
> > + uint32_t slot;
> > + bool rc;
> > +
> > +- rc = qxl_get_check_slot_offset(qxl, pqxl, &slot, &offset);
> > +- assert(rc == true);
> > + size = (uint64_t)height * abs(stride);
> > ++ rc = qxl_get_check_slot_offset(qxl, pqxl, &slot, &offset, size);
> > ++ assert(rc == true);
> > + trace_qxl_surfaces_dirty(qxl->id, offset, size);
> > + qxl_set_dirty(qxl->guest_slots[slot].mr,
> > + qxl->guest_slots[slot].offset + offset,
> > +--
> > +2.25.1
> > +
> > --
> > 2.25.1
> >
> >
> >
> >
> >
>
>
>
[Attachment #5 (text/html)]
<div dir="ltr"><div dir="ltr">On Tue, Jan 31, 2023 at 8:18 AM Martin Jansa via <a \
href="http://lists.openembedded.org">lists.openembedded.org</a> <Martin.Jansa=<a \
href="mailto:gmail.com@lists.openembedded.org">gmail.com@lists.openembedded.org</a>> \
wrote:<br></div><div class="gmail_quote"><blockquote class="gmail_quote" \
style="margin:0px 0px 0px 0.8ex;border-left:1px solid \
rgb(204,204,204);padding-left:1ex"><div dir="ltr">I haven't checked yet in \
dunfell, but in kirkstone this commit merged last week breaks nativesdk-qemu \
builds.</div></blockquote><div><br></div><div>I can confirm it fails the same with \
this commit from Hitendra in \
dunfell:</div><div><br></div><div>nativesdk-qemu/4.2.0-r0/qemu-4.2.0/hw/display/qxl.c:1508:67: \
error: 'size' undeclared (first use in this function); did you mean \
'gsize'?<br>| 1508 | if (!qxl_get_check_slot_offset(qxl, pqxl, \
&slot, &offset, size)) {<br>| | \
^~~~<br>| | \
gsize<br></div><div><br></div><div>as well as the same backport from <span \
style="color:rgb(51,51,51);font-family:sans-serif;font-size:13.3333px">Bhabu in \
kirkstone (already merged):</span></div><div><a \
href="https://git.openembedded.org/openembedded-core/commit/?h=kirkstone&id=4cb387 \
4abf4fdeb04337a48a14c765ba9b2269d4">https://git.openembedded.org/openembedded-core/commit/?h=kirkstone&id=4cb3874abf4fdeb04337a48a14c765ba9b2269d4</a><span \
style="color:rgb(51,51,51);font-family:sans-serif;font-size:13.3333px"><br></span></div><div><br></div><div>To \
reproduce this just enable "spice" PACKAGECONFIG in \
nativesdk-qemu.</div><div><br></div><div>Hitendra, <span \
style="color:rgb(51,51,51);font-family:sans-serif;font-size:13.3333px">Bhabu: please \
have a look.</span><br></div><div><span \
style="color:rgb(51,51,51);font-family:sans-serif;font-size:13.3333px"><br></span></div><div><span \
style="color:rgb(51,51,51);font-family:sans-serif;font-size:13.3333px">Regards,</span></div><div> \
</div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px \
solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div><br></div><div>This \
chunk:</div><div>+@@ -1486,7 +1505,7 @@ void *qxl_phys2virt(PCIQXLDevice *qxl, \
QXLPHYSICAL pqxl, int group_id)<br>+ offset = le64_to_cpu(pqxl) & \
0xffffffffffff;<br>+ return (void *)(intptr_t)offset;<br>+ case \
MEMSLOT_GROUP_GUEST:<br>+- if (!qxl_get_check_slot_offset(qxl, pqxl, \
&slot, &offset)) {<br>++ if (!qxl_get_check_slot_offset(qxl, pqxl, \
&slot, &offset, size)) {<br>+ return NULL;<br>+ \
}<br>+ ptr = \
memory_region_get_ram_ptr(qxl->guest_slots[slot].mr);<br></div><div><br></div><div>Uses \
size parameter which was added in previous commit (which wasn't \
backported):</div><div><a \
href="https://gitlab.com/qemu-project/qemu/-/commit/8efec0ef8bbc1e75a7ebf6e325a35806ece9b39f" \
target="_blank">https://gitlab.com/qemu-project/qemu/-/commit/8efec0ef8bbc1e75a7ebf6e325a35806ece9b39f</a><br></div><div><br></div><div>So \
either both commits need to be backported or this one reworked not to use undeclared \
size as it leads to:</div><div><br></div><div>| ../qemu-6.2.0/hw/display/qxl.c: In \
function 'qxl_phys2virt':<br>| ../qemu-6.2.0/hw/display/qxl.c:1477:67: error: \
'size' undeclared (first use in this function); did you mean \
'gsize'?<br>| 1477 | if (!qxl_get_check_slot_offset(qxl, pqxl, \
&slot, &offset, size)) {<br>| | \
^~~~<br>| | \
gsize<br></div><div><br></div><div>I'm surprised this wasn't caught on \
autobuilder already, maybe it's triggered only with extra PACKAGECONFIG options \
we have enabled:</div><div>PACKAGECONFIG:append:class-nativesdk = " \
virglrenderer epoxy spice libusb \
usb-redir"<br></div><div><br></div><div>Regards,</div><div><br></div></div><br><div \
class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, Jan 25, 2023 at 3:42 PM \
Steve Sakoman <<a href="mailto:steve@sakoman.com" \
target="_blank">steve@sakoman.com</a>> wrote:<br></div><blockquote \
class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid \
rgb(204,204,204);padding-left:1ex">From: Hitendra Prajapati <<a \
href="mailto:hprajapati@mvista.com" target="_blank">hprajapati@mvista.com</a>><br> \
<br>
Upstream-Status: Backport from <a \
href="https://gitlab.com/qemu-project/qemu/-/commit/6dbbf055148c6f1b7d8a3251a65bd6f3d1e1f622" \
rel="noreferrer" target="_blank">https://gitlab.com/qemu-project/qemu/-/commit/6dbbf055148c6f1b7d8a3251a65bd6f3d1e1f622</a><br>
<br>
Signed-off-by: Hitendra Prajapati <<a href="mailto:hprajapati@mvista.com" \
target="_blank">hprajapati@mvista.com</a>><br>
Signed-off-by: Steve Sakoman <<a href="mailto:steve@sakoman.com" \
target="_blank">steve@sakoman.com</a>><br>
---<br>
meta/recipes-devtools/qemu/qemu.inc | 1 +<br>
.../qemu/qemu/CVE-2022-4144.patch | 103 ++++++++++++++++++<br>
2 files changed, 104 insertions(+)<br>
create mode 100644 meta/recipes-devtools/qemu/qemu/CVE-2022-4144.patch<br>
<br>
diff --git a/meta/recipes-devtools/qemu/qemu.inc \
b/meta/recipes-devtools/qemu/qemu.inc<br> index fff2c87780..898fa1a8d8 100644<br>
--- a/meta/recipes-devtools/qemu/qemu.inc<br>
+++ b/meta/recipes-devtools/qemu/qemu.inc<br>
@@ -115,6 +115,7 @@ SRC_URI = "<a \
href="https://download.qemu.org/$%7BBPN%7D-$%7BPV%7D.tar.xz" rel="noreferrer" \
target="_blank">https://download.qemu.org/${BPN}-${PV}.tar.xz</a> \<br> \
file://CVE-2021-3638.patch \<br> file://CVE-2021-20196.patch \<br>
file://CVE-2021-3507.patch \<br>
+ file://CVE-2022-4144.patch \<br>
"<br>
UPSTREAM_CHECK_REGEX = "qemu-(?P<pver>\d+(\.\d+)+)\.tar"<br>
<br>
diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2022-4144.patch \
b/meta/recipes-devtools/qemu/qemu/CVE-2022-4144.patch<br> new file mode 100644<br>
index 0000000000..3f0d5fbd5c<br>
--- /dev/null<br>
+++ b/meta/recipes-devtools/qemu/qemu/CVE-2022-4144.patch<br>
@@ -0,0 +1,103 @@<br>
+From 6dbbf055148c6f1b7d8a3251a65bd6f3d1e1f622 Mon Sep 17 00:00:00 2001<br>
+From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <<a \
href="mailto:philmd@linaro.org" target="_blank">philmd@linaro.org</a>><br> +Date: \
Mon, 28 Nov 2022 21:27:40 +0100<br> +Subject: [PATCH] hw/display/qxl: Avoid buffer \
overrun in qxl_phys2virt<br> + (CVE-2022-4144)<br>
+MIME-Version: 1.0<br>
+Content-Type: text/plain; charset=UTF-8<br>
+Content-Transfer-Encoding: 8bit<br>
+<br>
+Have qxl_get_check_slot_offset() return false if the requested<br>
+buffer size does not fit within the slot memory region.<br>
+<br>
+Similarly qxl_phys2virt() now returns NULL in such case, and<br>
+qxl_dirty_one_surface() aborts.<br>
+<br>
+This avoids buffer overrun in the host pointer returned by<br>
+memory_region_get_ram_ptr().<br>
+<br>
+Fixes: CVE-2022-4144 (out-of-bounds read)<br>
+Reported-by: Wenxu Yin (@awxylitol)<br>
+Resolves: <a href="https://gitlab.com/qemu-project/qemu/-/issues/1336" \
rel="noreferrer" target="_blank">https://gitlab.com/qemu-project/qemu/-/issues/1336</a><br>
+<br>
+Signed-off-by: Philippe Mathieu-Daudà © <<a href="mailto:philmd@linaro.org" \
target="_blank">philmd@linaro.org</a>><br> +Signed-off-by: Stefan Hajnoczi <<a \
href="mailto:stefanha@redhat.com" target="_blank">stefanha@redhat.com</a>><br> \
+Message-Id: <<a href="mailto:20221128202741.4945-5-philmd@linaro.org" \
target="_blank">20221128202741.4945-5-philmd@linaro.org</a>><br> +<br>
+Upstream-Status: Backport [<a \
href="https://gitlab.com/qemu-project/qemu/-/commit/6dbbf055148c6f1b7d8a3251a65bd6f3d1e1f622" \
rel="noreferrer" target="_blank">https://gitlab.com/qemu-project/qemu/-/commit/6dbbf055148c6f1b7d8a3251a65bd6f3d1e1f622</a>]<br>
+CVE: CVE-2022-4144<br>
+Comments: Deleted patch hunk in qxl.h,as it contains change<br>
+in comments which is not present in current version of qemu.<br>
+<br>
+Signed-off-by: Hitendra Prajapati <<a href="mailto:hprajapati@mvista.com" \
target="_blank">hprajapati@mvista.com</a>><br> +---<br>
+ hw/display/qxl.c | 27 +++++++++++++++++++++++----<br>
+ 1 file changed, 23 insertions(+), 4 deletions(-)<br>
+<br>
+diff --git a/hw/display/qxl.c b/hw/display/qxl.c<br>
+index cd7eb39d..6bc8385b 100644<br>
+--- a/hw/display/qxl.c<br>
++++ b/hw/display/qxl.c<br>
+@@ -1440,11 +1440,13 @@ static void qxl_reset_surfaces(PCIQXLDevice *d)<br>
+ <br>
+ /* can be also called from spice server thread context */<br>
+ static bool qxl_get_check_slot_offset(PCIQXLDevice *qxl, QXLPHYSICAL pqxl,<br>
+- uint32_t *s, uint64_t \
*o)<br> ++ uint32_t *s, \
uint64_t *o,<br> ++ size_t \
size_requested)<br> + {<br>
+ uint64_t phys = le64_to_cpu(pqxl);<br>
+ uint32_t slot = (phys >> (64 - 8)) & 0xff;<br>
+ uint64_t offset = phys & 0xffffffffffff;<br>
++ uint64_t size_available;<br>
+ <br>
+ if (slot >= NUM_MEMSLOTS) {<br>
+ qxl_set_guest_bug(qxl, "slot too large %d >= %d", \
slot,<br> +@@ -1468,6 +1470,23 @@ static bool qxl_get_check_slot_offset(PCIQXLDevice \
*qxl, QXLPHYSICAL pqxl,<br> + slot, offset, \
qxl->guest_slots[slot].size);<br> + return false;<br>
+ }<br>
++ size_available = memory_region_size(qxl->guest_slots[slot].mr);<br>
++ if (qxl->guest_slots[slot].offset + offset >= size_available) {<br>
++ qxl_set_guest_bug(qxl,<br>
++ "slot %d offset %"PRIu64" \
> region size %"PRIu64"\n",<br> ++ \
slot, qxl->guest_slots[slot].offset + offset,<br> ++ \
size_available);<br> ++ return false;<br>
++ }<br>
++ size_available -= qxl->guest_slots[slot].offset + offset;<br>
++ if (size_requested > size_available) {<br>
++ qxl_set_guest_bug(qxl,<br>
++ "slot %d offset %"PRIu64" \
size %zu: "<br> ++ "overrun by \
%"PRIu64" bytes\n",<br> ++ slot, \
offset, size_requested,<br> ++ size_requested - \
size_available);<br> ++ return false;<br>
++ }<br>
+ <br>
+ *s = slot;<br>
+ *o = offset;<br>
+@@ -1486,7 +1505,7 @@ void *qxl_phys2virt(PCIQXLDevice *qxl, QXLPHYSICAL pqxl, int \
group_id)<br> + offset = le64_to_cpu(pqxl) & 0xffffffffffff;<br>
+ return (void *)(intptr_t)offset;<br>
+ case MEMSLOT_GROUP_GUEST:<br>
+- if (!qxl_get_check_slot_offset(qxl, pqxl, &slot, &offset)) \
{<br> ++ if (!qxl_get_check_slot_offset(qxl, pqxl, &slot, &offset, \
size)) {<br> + return NULL;<br>
+ }<br>
+ ptr = memory_region_get_ram_ptr(qxl->guest_slots[slot].mr);<br>
+@@ -1944,9 +1963,9 @@ static void qxl_dirty_one_surface(PCIQXLDevice *qxl, \
QXLPHYSICAL pqxl,<br> + uint32_t slot;<br>
+ bool rc;<br>
+ <br>
+- rc = qxl_get_check_slot_offset(qxl, pqxl, &slot, &offset);<br>
+- assert(rc == true);<br>
+ size = (uint64_t)height * abs(stride);<br>
++ rc = qxl_get_check_slot_offset(qxl, pqxl, &slot, &offset, size);<br>
++ assert(rc == true);<br>
+ trace_qxl_surfaces_dirty(qxl->id, offset, size);<br>
+ qxl_set_dirty(qxl->guest_slots[slot].mr,<br>
+ qxl->guest_slots[slot].offset + offset,<br>
+-- <br>
+2.25.1<br>
+<br>
-- <br>
2.25.1<br>
<br>
<br>
<br>
<br>
</blockquote></div>
<br>
<br>
<br>
</blockquote></div></div>
-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group.
View/Reply Online (#176508): https://lists.openembedded.org/g/openembedded-core/message/176508
Mute This Topic: https://lists.openembedded.org/mt/96521255/4454766
Group Owner: openembedded-core+owner@lists.openembedded.org
Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [openembedded-core@marc.info]
-=-=-=-=-=-=-=-=-=-=-=-
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic